Protected health information (PHI) is individually identifiable information about a person’s health, healthcare or payment for care held or transmitted by a covered healthcare organization or its business associate. It can be spoken, written or electronic. A patient’s name linked to an appointment or test result is PHI; information need not include a diagnosis to require protection.

The 18 Safe Harbor identifier categories in plain language are: 1 names; 2 geographic details smaller than a state (special ZIP-code rules apply); 3 dates directly related to a person other than year, including birth, admission, discharge and death dates, and ages over 89; 4 telephone numbers; 5 fax numbers; 6 email addresses; 7 Social Security numbers; 8 medical-record numbers; 9 health-plan beneficiary numbers; 10 account numbers; 11 certificate or license numbers; 12 vehicle identifiers and license plates; 13 device identifiers and serial numbers; 14 web addresses (URLs); 15 IP addresses; 16 biometric identifiers such as fingerprints and voiceprints; 17 full-face photographs and comparable images; 18 other unique identifying numbers, characteristics or codes. Removing a name alone does not de-identify a record; use an approved process and Privacy Officer guidance.

In a clinic, PHI lives in charts, appointment lists, sign-in sheets, voicemails, screens, printouts, referral messages and conversations. Position screens away from public view, protect printouts, use approved disposal and keep sign-in information limited according to policy. Do not leave messages or documents where an unauthorized person can read or hear them.

Scenario: a printed patient schedule is left at reception with names and appointment dates. It contains PHI. Secure it through the approved process and notify the appropriate lead if someone may have accessed it. Do not post a photo of the schedule in a personal group chat.

Spot the privacy risks in this exam room

1234

Tap each numbered marker to explore. 0 of 4 viewed.